When the resort changed ownership in 2022, its cybersecurity team moved away from their existing MSSP to re-imagine their security architecture, tooling and partners, the Executive Director of Cyber Security: Strategy, Architecture & Engineering, knew that Cribl Stream would be a critical element of the transition.
“From my vantage point, Cribl Stream is one of the most important tools in the cyber tool chest. I’ve saved literally half a million dollars a year — they’re allowing me to control my own data and make better use of my other investments and tools that have nothing to do with Cribl.”
Executive Director of Cyber Security: Strategy, Architecture & Engineering
An Immediate Reduction in SIEM Spend
Inspired by an impending ownership transition, the Executive Director and his team resolved to shift their operational approach. They opted to move from a fully outsourced SOC model to a hybrid SOC, integrating an in-house tech stack with tier one MSSP support. To ensure the transition remained within budgetary constraints and presented a cost-effective solution, the team found it necessary to segregate high-value data intended for analysis and detection from the high-volume data needed for regulatory compliance. Recognizing Cribl’s pivotal role in achieving this objective, they determined that prospective vendors onboard with Cribl as a prerequisite.
To get started, they deployed Cribl Stream along with Packs from the Cribl Packs Dispensary to rapidly filter logs and normalize the data traveling to Exabeam, their new SIEM and UEBA provider.
“By using the out-of-the-box filters, we were able to take our data throughput from 1.2 TB down to 800 GB per day. After briefly working with the Cribl team, we got down to 450 GB daily. That process was fast — we recognized the benefits very quickly.”
Executive Director of Cyber Security: Strategy, Architecture & Engineering
Instead of just indiscriminately funneling syslog into Exabeam Fusion they worked directly with Exabeam, their SIEM provider, to only send the information needed for Advanced Analytics and to drive detections. Thanks to the reduced data load they’ve realized by normalizing and optimizing data across all of their sources, the resort’s team has not only saved money on data lake storage for their SIEM, but they’ve also increased the speed of reporting across the platform.
Ease of Compliance With Regulatory Bodies
Large reductions in data and improved performance are the norm for Cribl Stream users, but unexpected benefits are also very common. The Executive Director was pleasantly surprised when the opportunity presented itself to re-think solutions for complying with casino-related data regulation.
“The number one reason we wanted to use Cribl Stream was the ability to reduce the amount of data ingestion going into the SIEM. But it's more important than that — once we started to learn more about the product, we found that we were able to filter data off, specifically for regulatory reporting, instead of having to pump it into our SIEM.”
Executive Director of Cyber Security: Strategy, Architecture & Engineering
Stream made it easy to send concise, masked, scaled-down subsets of information directly to the appropriate regulatory organizations with no concerns about confidentiality or storage.
A Seamless Transition With Zero Loss of Cybersecurity Coverage
It took the Executive Director and his team 60 days from the time they kicked off implementation to stand up a fully functional SOC. Due to heavy industry regulations, they had to run simultaneous coverage during the transition from their old MSSP to the new MSSP.
“We had to have a seamless flick of the switch —Cribl allowed us to take 30 data feeds and fork them to both the new and old platform so that our existing MSSP could continue to provide the service that we were paying them for, while simultaneously allowing us the time and energy to completely stand up a fully operational, brand new architecture.”
Executive Director of Cyber Security: Strategy, Architecture & Engineering
Ultimately, the Executive Director mitigated the risk of data loss and maintained comprehensive coverage during the transition.
“We literally lost zero coverage. We actually gained capability.”
Executive Director of Cyber Security: Strategy, Architecture & Engineering
Saving on Costs and Engineering Time
Using Cribl Stream to migrate to a new hybrid MSSP model and the Exabeam product suite has created a snowball effect in terms of time and money saved. They were able to reduce their SIEM license, while limiting staff hours spent handling regulatory data, and focus those resources on taking on new initiatives to better service the business. The Executive Director believes that by providing new opportunities to his team–not keeping them mired in data onboarding and repetitive reporting–also helps to address the staff churn so often faced by security teams.
“When you're sitting in my seat or a CISO seat, you're very concerned with dollars and resource management. Any time you can get a 60% reduction in that bill, and keep your team engaged and challenged, you feel like you’re in control of your own destiny, and that really helps a lot.”
Executive Director of Cyber Security: Strategy, Architecture & Engineering
Top-Notch Support from Vendors
The resort’s new MSSP does a lot of QA and fidelity checks on the logs sent via Stream, so they’ve also learned a lot about Cribl along the way. The Executive Director describes the relationship between two of his most widely used partners:
“Cribl has always immediately helped out. Their expediency and willingness to work with our vendors to solve a very complex problem is unique. Whenever any issues arise, the support team at Cribl has been right there to work with us to help us out.”
Executive Director of Cyber Security: Strategy, Architecture & Engineering
Since being acquired by a global private equity firm and bringing on Cribl Stream, the resort is considered to have the most mature cybersecurity team out of the hundreds of organizations under the umbrella of their portfolio. And you can bet they’ll continue to make strides to enhance their posture.
TL;DR
Built a fully functional CSOC in 60 days
Reduced SIEM license and infrastructure costs by 60%
Easily fork off regulatory data to appropriate destinations
Zero loss of cybersecurity coverage during the transition to new security architecture and vendors
Increased speed of detection and response
Recovered lost engineering time from automation of repetitive, time-consuming tasks
